Risk Management

What is Risk? Webster’s (Risk) – The possibility of suffering harm or loss; danger. The different types of risk Personal risk - How will this risk effect the individual i.e. loss of job, health, family life, and their ability to identify and address risk Professional risk – Will people have the courage to identify and response to risk i.e. peer and or management pressure. What is the culture of your team, program, company? Program risk – Is the risk process so narrow that suboptimum program decisions are made to the detriment of business areas or company goals Company risk – Do you think of things short term or long term, do you look at the impact across the business (car versus horse drawn carriage, great for my program but hurts other business areas) Community risk – How do your decisions impact the community around you locally, regionally, nationally, planet earth (Enron, Mortgage crisis) Identification of the different types of risk may make the difference between success and failure for you, the team, the company, or even the nation in some cases

Consequences of Risk Negative Positive Personal Personal Loss of job Lack of Promotion Pay freezes Emotionally destructive (fear, anxiety, passive) Company Loss of business Lower profits Lower stock price Reduced company viability Country (US – Oil no refiners, or alternate sources of energy) Lack of vision Short term focus Positive Personal Increased opportunities Promotions Pay increases Emotionally lifting (initiative, innovative, courage) Company Increased business Higher profits Stock price Increased market share/new markets Country (Canada – Oil tar sands, Dutch wind) Vision Long Term Focus

If Risk Management is important, how do we sell Risk Management to management? You create a need for it!!

Program Performance Assessment 198 Program Attributes Assessed from Pre-Proposal thru Contract Completion Program Phases: Pre-Proposal Proposal Pricing delegation Contract requirements Technical performance Contract execution Contract change Survey Tool Performance Assessment: 9 = excellence in addressing key characteristics 3 = fair performance in addressing key characteristics 1 = poor performance in addressing Database Established

Risk Management Key to Success What Was Done Well on Programs That Performed Well That Was Missing on Programs That Performed Poorly? Good program identified risk, assessment performed, integrated into program plan & tracked throughout life of program 2 areas 3 areas 5 areas Risk Management Area 2 Area 3 Area 4

Consistently Do Poorly on Problem Programs Pre-Proposal Risk & requirements understood 4 other areas Proposal Risk mitigation plan in place 3 other areas Delegation 1 other area Contract Change Contract Execution & Technical Performance 11 other areas Risk analysis & mitigation plan 4 other areas Score of <4, Scale of 1-3-9 Perceived as Areas of General ATK Weakness

Program Management Survey Results PMs that incorporate Risk Management Plan into their program – 78% Regularly use or implement risk management (monthly or less) – 50% PM’s that can find examples of previous program plans, risk analyses, schedules, etc.. to help me do my job – 44%

Program Management Process Rating Q11) Which of the following items have you incorporated into your program(s)? (Check all that apply.) Many key elements of a Design Plan and Program Plan not applied to programs

Program Management Process Rating Q12) How Regularly do you use or implement these items? (Check all that apply.)

What is Risk Management? Definition of Risk Management: Risk management is concerned with the outcome of future events, whose exact outcome is unknown, and with how to deal with these uncertainties, i.e., a range of possible outcomes. In general, outcomes are categorized as favorable or unfavorable, and risk management is the art and science of planning, assessing, and handling future events to ensure favorable outcomes. The alternative to risk management is crisis management, a resource-intensive process that is normally constrained by a restricted set of available options. “ Risk Management Guide for DoD Acquisition, fifth edition, version 2, June 2003”

What is Risk Management? Types of Risk Management: Hardware Feasible, stable, and well-understood user requirements and threat; A close relationship with user, industry, and other appropriate participants; A planned and structured risk management process, integral to the acquisition process; An acquisition strategy consistent with risk level and risk-handling strategies; Continual reassessment of program and associated risks; A defined set of success criteria for all cost, schedule, and performance elements, e.g., Acquisition Program Baseline (APB) thresholds; Metrics to monitor effectiveness of risk handling strategies; Effective Test and Evaluation Program; and Formal documentation

What is Risk Management? Types of Risk Management: Software Risk Management Identify software risk. Estimate the time and resources required to develop new software, resulting in potential risks in cost and schedule. Test software completely because of the number of paths that can be followed in the logic of the software. Develop new programs because of the rapid changes in information technology and an ever-increasing demand for quality software personnel. People Needs/Desires Determine relationships Relative power/influence Trust

What is the Risk Management Process

Defenses are Never Perfect What we don’t Know or don’t Believe Can and Will Hurt Us We perceive our ideal system of defenses like this. Mishap Potential losses (people and assets) But the reality is more like this. Source: James Reason, Managing the Risks of Organizational Accidents, 1997, p. 9

When Events Line Up, the Consequences Can Be Devastating A Hole is a Risk – A Weakness In a Plan – Any Plan People Events Facilities Materials Process Design Defenses in depth Product Design Program Plan Requirements (unspoken & spoken) Mishap Adapted from : James Reason, Managing the Risks of Organizational Accidents, 1997, p. 12

Engineering and Process Design Close Holes Ham and Swiss on Rye Voice of Customer (VOC) Requirements Definition Product Design Process Design Design FMEA / FTA Manufacturing Process FMEA Systems Engineering Process Control Peer Review To Close a Hole REQUIRES a Change – The Right Change at the Right Time Defensive Barrier Requirements Manufacturing Design Product Inspections Only Close Small Holes Engineering and Process Design Have High Leverage “Process” = ALL Processes, not just Hardware/Manufacturing

The Result is Mission Success Where are the Holes? The Essence of Mission Assurance Eliminate the Holes Shrink the Holes Make sure the Holes don’t Line up The Essence of Risk Management Find/Define the Holes So That We Can … Eliminate, Shrink, etc… The Result is Mission Success

Risk Management Model Incident Management Plan Plan Manage Risk Incidents Plan Plan Manage Risk Manage Risk Target Condition Current Condition

Risk Management If I know the risks I face, I can make better decisions If I know the risks up front, I can apply my resources in a planned manner rather than just reacting to problems with scarce resources A Key Role of a Leader is to Apply Resources at the DECISIVE Point and Time to Achieve Victory If I know the risks & appropriately mitigate the risks, I have more confidence that I will achieve Mission Success – I plug the holes in the Swiss Cheese

What Happened We found many Risk Management Tools We found no inclusive and defined Process “How to Identify the Risks” was Missing Applies @ All Levels, All People, Simple & Complex We defined the Principles We defined the Process Based on and consistent with the Principles We designed a simple tool to support the process

Emerging Risk Management Principles Have a Plan IMP/IMS, Product/Process Design, Material Plan, etc. Actions to Mitigate Risks get Rolled Back into the Plan Understand the Plan/Process Look at each step/item in a methodical fashion Include the Right People Can be Very Difficult, but is Critical to Success Thorough Discussion and Review Risk Management is an Individual Behavior Control Change – Make Changes Proactively There is a Cost for every Mitigation – Plan The Resources Solid Cost/Benefit Decisions are Necessary Planned Use of Resources vs. Ad Hoc “Head in the Sand” Take Planned Action – Plan And Make Change Plan the work, work the plan Follow up Hold teams and individuals accountable

Risk Management Process Flow *** The “ Map/Define ” step can use a number of Risk – An event that could happen to prevent me from reaching my Risk Levels Likelihood Severity Control Alternatives Identify options Identify resources Assess costs, benefits and impacts Plan actions Impacts Cost Schedule Performance tools such as process flow charts, program plans, goal. Integrated Master Plans, Design Trees, etc, to Condition – The reason this risk makes you uncomfortable. guide the risk identification effort. Consequence – The result if the risk event happens. Given a current Severity – The measure of the magnitude of the effect of the risk event condition and (consequence) on Cost, Schedule, Technical Performance, AUPC, & desired end state Safety. Risk Identification Likelihood – The subjective measure of probability that the risk event will occur. FMEA, PFMEA, FMECA - type methodology Risk Assessment Brainstorm voc For each step - Evaluate risks Map/Define potential risks feature, define for each step - for probability Risk No the process – 6 M ’ s, 3 W ’ s of occurrence Risk Tracker Requires ID critical feature with & Success multi - and severity of Action? features *** Criteria disciplinary consequence team Yes EAC Reviews Periodic Program Risk Risk Tracker Review Update the Plan IMP/IMS Design Process Budget Plan actions to Determine root reduce probability, Identify and Communicate the Risks Update reduce severity, Perform Actions causes of the Assess Risks (Reviews, Boards, Process or plan contingencies (Work the Plan) risk or further to the Plan Change Control, etc.) Plan understand risk Risk Handling 10/16/06

8/30/06

Planning & Resource Allocation Have a Plan, Work the Plan, Follow-up on the Plan Risk Management is Dependent on having a Plan The “Plan” is the “IMP/IMS” for a Program, the “Design” for a Product or Process, the “BOM” for Materials, etc. The process looks at each step in the plan to Identify Risks All Risk “Handling” Actions must be worked back into the Original Plan for application of Resources and Follow-up (IMP/IMS, Design, etc.) Planned Use of Resources is Critical to Effective Management of the Process Resources are Always Limited so Planning is necessary to Assure that Risk “Handling” Actions will actually be Implemented Leaders Allocate Resources – It is Inappropriate to merely bully subordinate and supporting organizations to implement Change without Allocating Sufficient Resources

The Process is Universal and Necessary Risk Management is universally applicable to and necessary in all parts of our processes. Too often it is only used at the Program level. People Events Facilities Materials Process Design Defenses in depth Product Design Program Plan Requirements (unspoken & spoken) Mishap Adapted from : James Reason, Managing the Risks of Organizational Accidents, 1997, p. 12

Accountability From Bottom to Top Executive Management ATK Customer Pull Program Manager Customer Functional Leadership Supporting Organizations Teams IPT’s Functional Teams Individuals Designers Builders Given a sound process and training, Risk Management is an individual behavior. The process linked with the right behavior = Success. This individual behavior is the foundation of Risk Management.

View from the Top How Leadership Views, Discusses and Responds to Identified Risks will Determine the Effectiveness of Handling Plans and will Determine Future Willingness to Identify Risks.

Risk Management Process Focus Implement a thorough risk management process Keep reporting simple Focus on reducing or eliminating risk through proactive risk management and initiating risk mitigation activities Minimize the temptation to “accept” risk

Risk Management Process & Responsibilities RM, TD IPT Leads Any Stakeholder RM, TD IPT Leads TD, RM IPT Leads TD, RM IPT Leads RMB, RM IPT Leads

Weekly Inputs to Risk Assessment Design, Manufacturing Capability Assessment Risk Management Board Trade Studies Lessons Learned Inclusion into Risk Tracker RMB Co-chaired by xxx RMB Members: RMB Advisors: RMB Facilitators: Requirements Walkthrough Analysis DFM/DFA’s Opportunity Data Base Risk Clarification & Clean up GN&C / Aero / SW / GPS Program Office Systems Engineering Systems Design Integration Test & Evaluation Electrical Mechanical Program Office (continued) Contracts Finance Quality Materials Production Transition Alliant Techsystems Proprietary

The Benefits of a robust Risk Management Process How can you make risk work for you It is a common trait of management to award people who put out fires more then they do the people who do things the right way such that you do not have fires. Unfortunately it is also true that the people who put out fires may have gathered the kindling and lit the match that started the fire in the first place through poor risk management or no risk management Good risk management helps give you visibility for doing the right things It highlights the risks It identifies the consequences It enables healthy discussion on strategies and actions for addressing risk It enables the individual to get the credit for doing the right things the first time

The Benefits of a robust Risk Management Process Actual Benefits from following “Good Risk Management Practices” Schedule It highlights the critical path Identifies what is driving the critical path Gets people talking and addressing the risk It gives you time to address the risk Money It gives you a forum to discuss money in a non threatening manner It provides reasons for making money available Reference viewgraph 3